Bug 101276 - Prototype chain caching should check that the path from the base object to the slot base involves prototype hops only
Summary: Prototype chain caching should check that the path from the base object to th...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on:
Blocks: 101147
  Show dependency tree / graph
 
Reported: 2012-11-05 16:32 PST by Filip Pizlo
Modified: 2012-11-05 17:54 PST (History)
2 users (show)

See Also:

Attachments
the patch (25.27 KB, patch)
2012-11-05 16:36 PST, Filip Pizlo 		barraclough: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2012-11-05 16:32:57 PST 
Patch forthcoming.
Comment 1 Filip Pizlo 2012-11-05 16:36:40 PST 
Created attachment 172435 [details]
the patch
Comment 2 Gavin Barraclough 2012-11-05 17:15:40 PST 
Comment on attachment 172435 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=172435&action=review

> Source/JavaScriptCore/runtime/Operations.h:309
> +            if (cell->inherits(&JSProxy::s_info))

You could use isProxy here if you like.
Comment 3 Filip Pizlo 2012-11-05 17:52:22 PST 
(In reply to comment #2)
> (From update of attachment 172435 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=172435&action=review
> 
> > Source/JavaScriptCore/runtime/Operations.h:309
> > +            if (cell->inherits(&JSProxy::s_info))
> 
> You could use isProxy here if you like.

Good point.  I changed it to use isProxy(), and moved isProxy() to JSCell as per our discussions.
Comment 4 Filip Pizlo 2012-11-05 17:54:03 PST 
Landed in http://trac.webkit.org/changeset/133546